Katalog CVE (hal. 541)

csirt@kutim:~/threat-intel/cve

$ cat README.txt

Isi katalog: semua CVE yang terbit di NVD sejak 2020 dan sudah memiliki skor CVSS, ditambah semua CVE dari tahun berapa pun yang masuk katalog KEV (Known Exploited Vulnerabilities) CISA. Saring dengan Severity "Critical" atau "High" untuk yang paling mendesak. Untuk analisis dan langkah penanganan yang ditulis KUTIM-CSIRT, lihat Advisory & Kerentanan.

> CVE di katalog: 263.295 (Critical 36.348 · High 105.272 · KEV 1.756 · sejak 2020) · Pembaruan terakhir: 25 Okt 2026, 18:25 WITA
> Sumber data: NVD (NIST) · KEV (CISA) · EPSS (FIRST), diperbarui tiap 6 jam

> Menampilkan 27.001–27.050 dari 263.295 CVE.

CVE	Severity	KEV	EPSS	Terbit
CVE-2026-82324 gimp, redhat enterprise linux A flaw was found in the file-iff (IFF/ILBM) plugin in GIMP. When processing a specially crafted IFF/ILBM image file, the plugin does not properly validate the HAM row siz...	6.1 Medium	—	0,19%	28 Agt 2026
CVE-2026-82227 Contributor SQL Injection in WPBulky <= 1.2.2 versions.	8.5 High	—	0,36%	28 Agt 2026
CVE-2026-82220 Unauthenticated Other Vulnerability Type in Forminator <= 1.57.1 versions.	5.3 Medium	—	0,29%	28 Agt 2026
CVE-2026-82181 Medical Practice Management System developed by Le-yan has a Sensitive Data in URL vulnerability. Unauthenticated remote attackers can obtain sensitive information via vi...	5.5 Medium	—	0,23%	28 Agt 2026
CVE-2026-82112 A flaw has been found in houtini-ai houtini-lm up to 2.13.2. The impacted element is an unknown function of the file src/index.ts of the component code_task_files. Execut...	3.5 Low	—	0,42%	28 Agt 2026
CVE-2026-82078 Advisory papercut mf, papercut ng An unsafe dynamic class loading vulnerability exists in the database connection utilities of PaperCut MF and PaperCut NG. The application instantiates database driver cla...	9.1 Critical	KEV	63,5%	28 Agt 2026
CVE-2026-81767 Unauthenticated Broken Access Control in Simple Payment <= 2.5.2 versions.	7.5 High	—	0,35%	28 Agt 2026
CVE-2026-81761 Subscriber Broken Access Control in WpEvently <= 5.5.0 versions.	4.3 Medium	—	0,27%	28 Agt 2026
CVE-2026-81760 Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Crocoblock JetEngine allows Reflected XSS. This issue affects JetEn...	7.1 High	—	0,25%	28 Agt 2026
CVE-2026-81759 Contributor Broken Access Control in WpEvently <= 5.5.0 versions.	5.4 Medium	—	0,29%	28 Agt 2026
CVE-2026-81757 Author Remote Code Execution (RCE) in Rank Math SEO <= 1.0.276 versions.	7.2 High	—	0,78%	28 Agt 2026
CVE-2026-81578 Advisory papercut mf, papercut ng An improper access control vulnerability exists in the web management interface of PaperCut MF and PaperCut NG. Under specific conditions, unauthenticated remote requests...	9.8 Critical	KEV	85,6%	28 Agt 2026
CVE-2026-81341 wolfssl wolfengine wolfEngine before 1.4.1 sources the explicit AES-CCM nonce for TLS 1.2 and DTLS 1.2 records from the record input buffer instead of the TLS sequence number carried in the...	6.5 Medium	—	0,32%	28 Agt 2026
CVE-2026-81299 Subscriber Insecure Direct Object References (IDOR) in WP Job Portal <= 2.5.9 versions.	4.3 Medium	—	0,25%	28 Agt 2026
CVE-2026-81285 Unauthenticated Denial of Service Attack in Smush Image Compression and Optimization <= 4.2.0 versions.	7.5 High	—	0,46%	28 Agt 2026
CVE-2026-81284 Contributor Broken Access Control in ACF Extended <= 0.9.2.6 versions.	4.3 Medium	—	0,25%	28 Agt 2026
CVE-2026-81020 wolfssl wolfengine wolfEngine before 1.4.1 generates the 8-byte explicit AES-GCM nonce once when the TLS write key is set and never increments it per record. As a result every TLS 1.2 and D...	7.4 High	—	0,38%	28 Agt 2026
CVE-2026-81019 wolfssl wolfprovider wolfProvider before 1.2.2 generates the 8-byte explicit AES-GCM nonce once when the TLS write key is set and never increments it per record. As a result every TLS 1.2 and...	7.4 High	—	0,38%	28 Agt 2026
CVE-2026-75758 Uncontrolled Recursion vulnerability in the Elixir standard library allows an attacker who controls a list passed to inspect/1, List.to_string/1, or List.to_charlist/1 to...	5.9 Medium	—	0,18%	28 Agt 2026
CVE-2026-6176 The Customer Reviews for WooCommerce plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the aggregated review form submission in versions up to and inc...	7.2 High	—	0,42%	28 Agt 2026
CVE-2026-5953 Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Ceviz Informatics Inc. Web Design allows Reflected XSS. This issue...	6.1 Medium	—	0,25%	28 Agt 2026
CVE-2026-5934 The WP Rocket plugin for WordPress is vulnerable to Stored Cross-Site Scripting in versions up to, and including, 3.21.0.1. This is due to insufficient input sanitization...	7.2 High	—	0,34%	28 Agt 2026
CVE-2026-5800 Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Dayneks Software Industry and Trade Inc. E-Commerce Platform allows...	6.1 Medium	—	0,25%	28 Agt 2026
CVE-2026-58107 CodeChecker's massStoreRun processing path performs one-shot decompression of attacker-controlled, Base64-encoded zlib data without enforcing a maximum decompressed size....	5.5 Medium	—	0,41%	28 Agt 2026
CVE-2026-58106 CVE-2025-40843 https://github.com/advisories/GHSA-5xf2-f6ch-6p8r was fixed by replacing unchecked strcpy() with a bounded safe_strcpy() helper. At ldlogger-tool-gcc.c:12...	2.0 Low	—	0,17%	28 Agt 2026
CVE-2026-5096 The Everest Forms plugin for WordPress is vulnerable to Server-Side Request Forgery in all versions up to, and including, 3.4.4. This is due to the `load_previous_field_v...	5.3 Medium	—	0,41%	28 Agt 2026
CVE-2026-56854 The source-address critical option in the Permissions returned by an authentication callback was only enforced for the PublicKeyCallback and VerifiedPublicKeyCallback pat...	7.5 High	—	0,44%	28 Agt 2026
CVE-2026-50979 A command injection vulnerability in the 'advanced/curl' component of Osbil Technology oPanel v1.19.50 and earlier allows authenticated attackers to execute arbitrary she...	8.1 High	—	1,9%	28 Agt 2026
CVE-2026-4378 Improper neutralization of input during web page generation ('cross-site scripting') vulnerability in Akilli Ticaret Software Technologies Ltd. E-Commerce Pack allows Sto...	5.4 Medium	—	0,23%	28 Agt 2026
CVE-2026-3423 The Envira Gallery plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the gallery 'description' configuration field in all versions up to, and includin...	6.4 Medium	—	0,33%	28 Agt 2026
CVE-2026-38725 xipblog module v2.0.1 and before for PrestaShop allows unauthenticated remote attackers to inject arbitrary JavaScript via the name and content parameters in ajax.php. Th...	5.4 Medium	—	0,31%	28 Agt 2026
CVE-2026-38638 An issue in the with_argv function (/unistd/mod.rs) of relibc commit 61f42d allows attackers to cause a Denial of Service (DoS) via a crafted input.	7.5 High	—	0,63%	28 Agt 2026
CVE-2026-38636 An issue in the seekdir() function (/dirent/mod.rs) of relibc commit 61f42d allows attackers to cause a Denial of Service (DoS) via a crafted input.	7.5 High	—	0,63%	28 Agt 2026
CVE-2026-38093 file_picker (aka flutter_file_picker) for Flutter, all versions through 10.3.10, is vulnerable to path traversal (CWE-22) in its Android implementation. The openFileStrea...	3.3 Low	—	0,16%	28 Agt 2026
CVE-2026-37751 An OS command injection vulnerability in the killSessionSync function (lib/agent-runtime.ts) of 23blocks-OS ai-maestro v0.24.17 allows attackers to execute arbitrary comm...	9.8 Critical	—	2,9%	28 Agt 2026
CVE-2026-37736 An issue in the JsonSanitizer.sanitize() component of OWASP json-sanitizer v1.2.3 allows attackers to cause a Denial of Service (DoS) via a crafted input.	7.5 High	—	0,49%	28 Agt 2026
CVE-2026-37710 Cross Site Scripting vulnerability in Omeka S v.4.2.0 allows a remote attacker to execute arbitrary code via the site navigation custom URL function	6.1 Medium	—	0,50%	28 Agt 2026
CVE-2026-37237 vllm vLLM up to and including 0.17.0 allows remote attackers to cause a Denial of Service via memory exhaustion. The AsyncMediaIO.fetch_audio and AsyncMediaIO.fetch_image func...	7.5 High	—	0,73%	28 Agt 2026
CVE-2026-37236 grpc-gateway v2.28.0 is vulnerable to Incorrect Access Control. The application processes the X-HTTP-Method-Override header in ServeMux.ServeHTTP without restricting allo...	9.8 Critical	—	0,43%	28 Agt 2026
CVE-2026-19412 This vulnerability exists in the CP Plus CP-XR-DE21-S Router due to the presence of hardcoded HTTP Digest authentication credentials in the firmware that are identical ac...	8.7 High	—	0,19%	28 Agt 2026
CVE-2026-15603 morgan project morgan morgan is an HTTP request logger middleware for Node.js. In versions prior to 1.12.0, the internal helper that escapes log token values did not neutralize the Unicode lin...	5.3 Medium	—	0,29%	28 Agt 2026
CVE-2026-13761 Pega Platform versions 7.1.0 through 25.1.2 are affected by an improper validation of inputs that are used for loop conditions, potentially leading to a denial of service...	8.8 High	—	0,25%	28 Agt 2026
CVE-2026-82261 sveltekit SvelteKit (@sveltejs/kit) versions >=2.49.0 and <=2.52.1 with experimental remote functions and form enabled contain a CPU exhaustion vulnerability in form deserializatio...	7.5 High	—	0,49%	28 Agt 2026
CVE-2026-82260 sveltekit SvelteKit (@sveltejs/kit) versions >=2.49.0 and <=2.52.1 with experimental remote functions (experimental.remoteFunctions) and form enabled contain a memory exhaustion vu...	7.5 High	—	0,49%	28 Agt 2026
CVE-2026-82259 sveltekit SvelteKit versions from 2.49.0 through 2.53.2 (fixed in 2.53.3) contain a deserialization expansion issue in the experimental form remote function. When an application en...	7.5 High	—	0,53%	28 Agt 2026
CVE-2026-82258 sveltekit SvelteKit versions from 2.38.0 before 2.60.1 contain a race condition in query.batch that allows concurrent requests from different users to merge under a single request...	4.8 Medium	—	0,24%	28 Agt 2026
CVE-2026-82257 sveltekit SvelteKit versions before 2.69.1 contain a prototype pollution vulnerability in remote form functions with file input fields that accept arbitrary user-controlled path na...	4.3 Medium	—	0,36%	28 Agt 2026
CVE-2026-82256 sveltekit SvelteKit before 2.69.1 fails to properly validate remote form function payload sizes, allowing attackers to crash the Node process by sending large payloads. Repeated ex...	5.3 Medium	—	0,42%	28 Agt 2026
CVE-2026-82255 gitoxide versions from 0.25.4 contain an HTTP credential leak vulnerability in the curl-based transport backend where credentials are sent to attacker-controlled servers...	6.8 Medium	—	0,38%	28 Agt 2026
CVE-2026-82254 gitoxide before 0.69.0 contains unchecked array indexing in delta application and uncapped allocation from attacker-controlled size headers in gix-pack. Attackers can sen...	7.5 High	—	0,49%	28 Agt 2026

Cara membaca. CVSS adalah skor keparahan 0–10 dari NVD; bila NVD belum menganalisis, dipakai skor dari penerbit CVE (CNA). KEV berarti CISA sudah melihat kerentanan itu dieksploitasi, jadi utamakan penambalannya. EPSS (FIRST) adalah perkiraan peluang kerentanan dieksploitasi dalam 30 hari ke depan. Deskripsi ditampilkan dalam bahasa Inggris sesuai sumber aslinya. Kalau sistem di Perangkat Daerah memakai produk yang terdampak dan butuh bantuan, laporkan lewat kanal pelaporan KUTIM-CSIRT.